Multi-class detection and classification of security attacks in IoT networks using machine learning based on BoT-IoT dataset

Abstract

The rapid proliferation of Internet of Things (IoT) and Wireless Sensor Network (WSN) devices has significantly expanded the attack surface of modern networks, making effective intrusion detection mechanisms essential. However, many existing intrusion detection studies rely on outdated benchmark datasets, such as KDD Cup 99, NSL-KDD, and DARPA, which fail to capture the characteristics of contemporary IoT traffic. Furthermore, prior research frequently focuses on binary classification and overlooks the severe class imbalance inherent in real-world IoT datasets, as well as the computational constraints of IoT environments. This thesis experimentally evaluates several machine learning models for the detection and multi-class classification of attacks in IoT networks using a stratified subset of the BoT-IoT dataset. The study systematically investigates the impact of different class imbalance handling techniques, including random oversampling, random undersampling, Synthetic Minority Oversampling Technique (SMOTE), and cost-sensitive learning. Several classifiers are assessed under these conditions, namely Random Forest, Gradient Boosting, Logistic Regression, and Artificial Neural Networks (ANNs), to determine their effectiveness in detecting diverse attack categories. Performance is evaluated using several metrics, including accuracy, macro-averaged recall, and macro-averaged F1-score, together with computational measures such as training time and testing time. The results demonstrate that the choice of classifier and imbalance-handling strategy has a substantial impact on detection performance. In particular, the study compares standard models with oversampling, undersampling, SMOTE, and class-weighted/cost-sensitive variants, highlighting trade-offs between predictive performance and computational overhead. The experimental findings show that imbalance-aware training improves multi-class attack detection compared with unadjusted baseline models, while cost-sensitive learning offers a promising alternative to resampling-based approaches by reducing data processing overhead. Overall, the thesis identifies model–strategy combinations that better balance detection effectiveness and efficiency, supporting the development of practical intrusion detection systems for resource-constrained IoT environments.

Date	24 Aug 2026
Original language	American English
Awarding Institution	École de technologie supérieure
Supervisor	Michel Kadoch (Supervisor)